Privacy Policy
Effective date: January 27, 2026 · Last updated: June 1, 2026
1. Introduction
Harris Capital Mortgage Group, LLC (NMLS# 1918223) (“HCMG,” “we,” “us,” or “our”) operates hcmgloans.com and related internal platforms including our Liftoff operations portal. This Privacy Policy explains how we collect, use, share, and protect your information when you use our website, mortgage services, and internal loan origination tools.
As a licensed mortgage company, we are subject to the Gramm-Leach-Bliley Act (GLBA), Regulation P (12 CFR Part 1016), the Real Estate Settlement Procedures Act (RESPA), the Equal Credit Opportunity Act (ECOA), and applicable state mortgage privacy laws in Alabama, California, Colorado, Florida, Georgia, Maryland, Mississippi, Nevada, Texas, Virginia, and Washington D.C.
2. Information We Collect
We may collect the following categories of information from website visitors, loan applicants, and loan officers:
- Contact information: name, email address, phone number, mailing address
- Mortgage-related inputs: price range, income range, credit range, loan goals, loan purpose, loan amount, purchase price, property address
- Loan transaction data: ARIVE loan numbers, loan type, lock status, earnest money, seller credits, income notes, asset notes, credit notes (collected from licensed loan officers submitting requests through our internal Liftoff system)
- Credit scores: Experian, Equifax, and TransUnion credit score values, received from Starting Now Corporation as part of a credit repair referral status update when a borrower has been referred by their loan officer
- Usage data: pages visited, time on site, referring URL, funnel interactions
- Device and browser information: IP address, browser type, operating system
- Gift fund donor information: name, address, phone, email (when applicable)
3. How We Use Your Information
- Processing mortgage applications and loan origination requests
- Connecting you with licensed Harris Capital Mortgage Group loan officers
- Sending SMS and email communications if you have consented
- Coordinating loan disclosures, registrations, submissions, and lock requests through our internal operations team
- Improving our website and services
- Fraud detection and rate limiting (IP address used to detect abuse)
- Complying with legal obligations (RESPA, ECOA, GLBA, TRID, state mortgage regulations)
4. SMS Communications
We may send you SMS messages if you provided your phone number and consented to receive texts. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for assistance. We do not sell your phone number to third parties. See our SMS Policy for full details.
5. Data Sharing & Service Providers
We do not sell your personal information. We may share your information with the following parties strictly for the purposes listed below:
Harris Capital Mortgage Group Personnel
- Licensed loan officers who will contact you regarding your mortgage inquiry
- Operations and processing staff who handle loan registrations, disclosures, and submissions through our internal Liftoff platform
Technology Service Providers
The following service providers process data on our behalf under confidentiality and service provider agreements. Each is bound by their own privacy policy and security certifications as noted:
| Provider | Service | Data Received | Certification |
|---|---|---|---|
| Supabase, Inc. | Database & authentication | All loan and user data (stored in managed PostgreSQL) | SOC 2 Type II |
| Resend, Inc. | Transactional email delivery | Borrower first name, ARIVE loan number, loan type, submitter email, included in operational email notifications. Credit scores are never included in email bodies. | SOC 2 Type II |
| Zapier, Inc. | Workflow automation, ARIVE loan data lookup | ARIVE loan number, borrower name, loan type, property address, loan amount, transmitted transiently to retrieve loan details from ARIVE and return them to our system. Data is not stored by Zapier beyond task execution logs. | SOC 2 Type II |
| Vercel, Inc. | Web hosting & serverless functions | HTTP request metadata (IP address, headers) for all web traffic, not stored long-term | SOC 2 Type II, ISO 27001 |
| PostHog, Inc. | Analytics & session replay | Anonymized page view events, funnel interactions, no NPI. Session replay is masked for form fields. | SOC 2 Type II |
| Cloudflare, Inc. | Bot protection (Turnstile) | Browser fingerprint data for bot challenge verification on public lead forms | ISO 27001, SOC 2 |
| Starting Now Corporation | Credit repair referral services | Borrower first name, last name, email address, phone number, city, and state — shared only when a licensed loan officer refers a borrower for credit repair services through our internal Liftoff platform. Borrower consent is confirmed by the loan officer before any referral is submitted. Starting Now is bound by a signed Service Provider Agreement requiring them to protect this information and use it solely for the purpose of delivering credit repair services. Starting Now may return credit score data (Experian, Equifax, TransUnion) to HCMG as part of client status updates; these scores are stored securely and are only accessible to the referring loan officer and HCMG administrators. | Subject to signed Service Provider Agreement |
- Legal authorities when required by applicable law, court order, or regulatory requirement
6. Data Retention
We retain your information only as long as necessary to provide our services and meet legal obligations:
- FHA and VA loan files: 2 years post-closing per HUD Handbook 4000.1 and VA Lender Handbook
- Conventional and other loan files: 7 years post-closing per GLBA and state mortgage regulations
- Marketing and lead inquiry data: Until you opt out or request deletion, or 7 years from last contact, whichever is earlier
- ARIVE lookup results: 120 seconds (automatically deleted after use, these are transient lookups only)
- Credit score data from Starting Now Corporation: 3 years from the date of the last status update received from Starting Now, then permanently deleted
- Session tokens: 7 days, then automatically expired
After the applicable retention period, records are archived and then permanently deleted in accordance with our Written Information Security Program (WISP).
7. Your Rights
Depending on your state of residence, you may have the following rights regarding your personal information:
- Right to know: Request a copy of the personal information we hold about you
- Right to correct: Request correction of inaccurate personal information
- Right to delete: Request deletion of your personal information (subject to legal retention requirements, mortgage records must be retained per GLBA and HUD regulations)
- Right to opt out of sale: We do not sell your personal information
To exercise any of these rights, submit a request at hcmgloans.com/privacy/data-request or email privacy@hcmgloans.com. We will respond within 30 days (45 days for Virginia VCDPA requests). We may ask you to verify your identity before processing your request.
8. Security Safeguards
We maintain physical, electronic, and procedural safeguards to protect your nonpublic personal information (NPI) in compliance with the GLBA Safeguards Rule (16 CFR Part 314). These include:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for all data at rest (managed by Supabase)
- Row-Level Security (RLS) in our database, each user can only access data they are authorized to see
- HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options) to prevent web-layer attacks
- Distributed rate limiting on all authentication and data-submission endpoints
- Session tokens stored as cryptographically random UUIDs in HttpOnly, SameSite=Strict cookies
- Role-based access control, ops staff, lock desk agents, and help desk agents each have scoped access to only the loan queues relevant to their role
9. GLBA Annual Privacy Notice
As a mortgage company and covered financial institution under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6827), we provide this annual notice of our privacy practices as required by Regulation P (12 CFR Part 1016).
| What We Share | Does HCMG Share? | Can You Limit? |
|---|---|---|
| For our everyday business purposes — processing your loan, maintaining your account, responding to court orders and legal investigations | Yes | No |
| For our marketing purposes — to offer our products and services to you | No | We don't share |
| For joint marketing with other financial companies | No | We don't share |
| For non-affiliates to market to you | No | We don't share |
| For credit repair referral services — sharing your contact information with Starting Now Corporation when your loan officer refers you for credit repair services | Yes — only when referred by your LO with your consent | Yes — tell your loan officer not to submit a referral, or do not consent when asked |
To opt out of credit repair referral sharing: Inform your loan officer that you do not wish to be referred to Starting Now Corporation. Your loan officer is required to obtain your consent before submitting a referral — you may decline at any time before the referral is sent. Once a referral has been submitted, contact us at privacy@hcmgloans.com to request that your information be removed from Starting Now's system.
10. Cookies and Tracking
We use session cookies for authentication (HttpOnly, not accessible to JavaScript) and analytics cookies from PostHog to understand how visitors use our website. We do not use cross-site tracking cookies. You can disable analytics cookies through your browser settings, this will not affect your ability to use our mortgage services.
11. Children's Privacy
Our website and services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact us immediately at privacy@hcmgloans.com.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes affecting how we use your NPI, we will notify you by email or by posting a prominent notice on our website at least 30 days before the change takes effect.
13. Contact
Privacy inquiries and data requests:
Email: privacy@hcmgloans.com
Online: hcmgloans.com/privacy/data-request
Harris Capital Mortgage Group, LLC
NMLS# 1918223
HQ: 6375 S Pecos Rd, Suite 208, Las Vegas, NV 89120
Branch: 9801 Westheimer Ave, Suite 300, Houston, TX 77032
Equal Housing Lender. Licensed to originate mortgages in Alabama, California, Colorado, Florida, Georgia, Maryland, Mississippi, Nevada, Texas, Virginia, and Washington D.C. NMLS Consumer Access: nmlsconsumeraccess.org